Practice set 4 of 16 · AI-200 Exam Preparation
This set features 48 realistic scenario questions covering AKS, Cosmos DB, Key Vault, aligned directly with the official Microsoft Azure AI Cloud Developer Associate (AI-200) syllabus.
Set 4 challenges your understanding of data consistency models, vector distance operators, and zero-trust container networking: Domain 1 (25%), Domain 2 (25%), Domain 3 (27%), and Domain 4 (23%).
Which tier is required for Service Bus topics?
Shortcut: Basic supports queues only. Topics and subscriptions require Standard or Premium; Premium adds dedicated capacity, predictable latency, and larger message sizes.
You need to prevent a node pool from running user workloads while still allowing kube-system pods. Which mechanism do you use?
Shortcut: Tainting system nodes with CriticalAddonsOnly:NoSchedule (added automatically to system node pools) prevents regular workloads from scheduling. kube-system pods have the matching toleration.
Which Cosmos DB API is recommended for storing and querying AI embeddings using vector search?
Shortcut: Cosmos DB for NoSQL supports DiskANN-based vector indexing for efficient approximate nearest neighbour (ANN) search, ideal for storing and querying AI embeddings alongside structured data.
An Azure Function uses Key Vault References in its App Settings. Which managed identity type must be configured?
Shortcut: ) reference at runtime.
How does Service Bus message deduplication prevent duplicate processing?
Shortcut: Enable duplicate detection on a queue or topic. Service Bus stores MessageIds for the detection window (up to 7 days). Duplicate sends with the same MessageId are discarded.
An AKS cluster needs to pull images from a private ACR. What is the recommended authentication approach for production?
Shortcut: az aks update --attach-acr creates an AcrPull role assignment on the AKS kubelet identity. This uses managed identity, avoiding stored credentials.
You need to react to every insert and update in a container in near real time, in order, without polling. Which feature applies?
Shortcut: The change feed is a persistent, ordered log of creates and updates per logical partition. The change feed processor distributes leases across workers for scalable consumption.
What does enabling Key Vault private endpoint achieve?
Shortcut: A private endpoint assigns a private IP to Key Vault within the VNet. Combined with disabling public network access, this ensures the vault is only reachable from within the VNet.
Which filtering capability lets you match on a custom field inside the event data payload?
Shortcut: * properties, supporting string, numeric, and boolean operators.
You must guarantee that a critical pod is rescheduled elsewhere if its node is drained, and that at least 2 replicas stay available during voluntary disruptions. Which object do you create?
Shortcut: A PodDisruptionBudget constrains voluntary disruptions such as node drains and upgrades. minAvailable: 2 blocks the drain from evicting below two ready replicas.
Which Flexible Server high availability mode provides automatic failover to a standby in a different availability zone?
Shortcut: Zone-redundant HA places the primary and standby in separate availability zones. This protects against zone-level failures with automatic failover in ~60–120 seconds.
Which built-in role permits reading secret values but not managing the vault?
Shortcut: Key Vault Secrets User grants data-plane read of secret values. Key Vault Reader sees metadata only; Contributor manages the resource but not necessarily data.
Which TWO conditions cause a message to be moved to the dead-letter queue automatically?
Shortcut: Exhausting the delivery attempts and TTL expiry with EnableDeadLetteringOnMessageExpiration are the two automatic paths to the dead-letter sub-queue. Completing settles the message successfully, renewal simply extends the lock, and duplicate detection silently drops the repeat rather than dead-lettering it.
What is the difference between single revision mode and multiple revision mode in Container Apps?
Shortcut: Single revision mode replaces the active revision on each deploy. , 90/10 for A/B testing).
Which Azure Database for PostgreSQL Flexible Server feature provides the lowest-latency read scale-out for a reporting workload?
Shortcut: Read replicas serve read-only traffic and offload the primary. The HA standby is not readable, and backups are for recovery, not query serving.
A Kubernetes cluster sends container logs and metrics to Azure Monitor. Which feature provides container-specific insights?
Shortcut: Container Insights collects container stdout/stderr logs, performance metrics (CPU, memory, network) from AKS, and provides pre-built dashboards for node, pod, and container monitoring.
Which Event Grid feature allows filtering events by subject, event type, or advanced JSON field matching before delivery?
Shortcut: ) on any event payload field.
Which secret management approach avoids storing secret values in the Container App definition?
Shortcut: Container Apps secrets can reference a Key Vault secret URI and resolve it at runtime using the app's managed identity, so the value never appears in the ARM/Bicep definition.
Which Redis command implements a cache-aside pattern by setting a value with an expiration time in one atomic operation?
Shortcut: Both SETEX key seconds value and SET key value EX seconds atomically set a value with an expiry. SET key value EX seconds is the modern preferred form supporting additional options.
Telemetry volume is driving unacceptable cost. Which technique reduces ingestion while preserving representative data?
Shortcut: Sampling discards a proportion of telemetry while preserving statistical accuracy, and keeps related items together so traces remain coherent. Retention changes storage cost, not ingestion cost.
Which feature writes the event stream automatically to Blob Storage or Data Lake without writing code?
Shortcut: Capture persists batches to storage in Avro format on a size or time window, providing a durable archive for batch analytics and replay.
Which AKS identity feature replaces pod-managed identity (preview) and uses OIDC federation for secure Azure resource access without stored credentials?
Shortcut: Workload Identity (GA) uses OIDC federation between the AKS service account and an Azure managed identity, eliminating stored secrets. It replaces the deprecated AAD Pod Identity.
Which eviction policy suits a pure cache where the least recently used entries should be discarded under memory pressure?
Shortcut: allkeys-lru evicts the least recently used key regardless of TTL, which is the standard choice for a cache. noeviction would instead return write errors when memory fills.
A Durable Function implements a human approval workflow that may wait days for a response. Which Durable Function pattern is appropriate?
Shortcut: The human interaction pattern uses WaitForExternalEvent() to pause orchestration indefinitely until an external event (approval, rejection) is raised via the Durable Task API or HTTP.
What is an Azure custom RBAC role?
Shortcut: Storage/storageAccounts/read) and notActions (excluded actions) to implement least-privilege beyond built-in roles.
How do you upgrade the Kubernetes version of an AKS cluster control plane?
Shortcut: az aks upgrade upgrades the control plane first, then node pools (or separately). You can then upgrade node pools individually with az aks nodepool upgrade.
What does DiskANN vector indexing in Cosmos DB optimize for?
Shortcut: DiskANN is a disk-based ANN algorithm that enables efficient vector similarity search (cosine, dot product, Euclidean) on high-dimensional embeddings stored in Cosmos DB.
Which constraint applies to Durable Functions orchestrator code?
Shortcut: Orchestrators replay their history to rebuild state, so non-deterministic operations would diverge. CurrentUtcDateTime and perform I/O inside activity functions.
Which principle should guide the scope chosen for a role assignment?
Shortcut: Least privilege means scoping to the specific resource or resource group needed. Broad assignments increase blast radius if the identity is compromised.
You need to reduce ACR storage costs. Untagged manifests accumulate from repeated CI builds. Which approach removes them on a schedule with the least custom code?
Shortcut: az acr purge is packaged as a container that ACR Tasks can run on a timer trigger. It handles untagged manifests and age filters natively, with no external orchestration.
What is the maximum vector dimension supported by pgvector?
Shortcut: pgvector supports up to 2000 dimensions; however, HNSW indexing is currently limited to 2000 and IVFFlat to 2000. Most embedding models produce 768 or 1536 dimensions.
Which Event Hubs feature automatically captures streaming data to Azure Blob Storage or Data Lake Storage Gen2 without writing consumer code?
Shortcut: Event Hubs Capture automatically archives events to Blob Storage or ADLS Gen2 in Avro format at configurable time/size intervals, enabling long-term storage without custom consumer code.
How does Key Vault protect against accidental permanent deletion of critical secrets?
Shortcut: Soft delete moves deleted objects to a 'deleted' state recoverable within 7–90 days. Purge protection (when enabled) prevents anyone from permanently deleting objects during the retention period.
What does ACR Content Trust provide?
Shortcut: Content Trust uses Notary (OCI signing) to sign images. When enabled on a registry, only images with verified signatures can be pulled.
Which limitation of the Cosmos DB change feed must you design around?
Shortcut: The change feed records creates and updates only. To capture deletes, use soft deletes (a deleted flag plus TTL) so the update appears in the feed.
An operation must publish a message only if a database write succeeds, with no possibility of one without the other. Which pattern applies?
Shortcut: Service Bus transactions cannot span an external database. The outbox pattern writes the message into the same database transaction, then a relay publishes it, guaranteeing consistency.
Which KQL query counts the number of failed HTTP requests (resultCode 5xx) in Application Insights over the last hour?
Shortcut: requests | where timestamp > ago(1h) | where success == false | count queries the requests table, filters to the last hour, filters on failed requests (success==false covers 4xx/5xx), and counts them.
Which construct restricts a developer to read-only access on pods within only the 'dev' namespace?
Shortcut: Namespace-scoped Role plus RoleBinding is the least-privilege construct. A ClusterRoleBinding would grant the permission across every namespace.
A team needs to implement a distributed lock in Redis to prevent concurrent access to a shared resource across multiple application instances. Which approach is recommended?
Shortcut: SET key value NX EX seconds atomically sets the key only if it doesn't exist (NX) with an expiry. This is the foundation of the Redlock algorithm for distributed locking.
An application uses a Service Bus topic with three subscriptions. Message A is sent with no filters. How many copies of the message do consumers receive in total?
Shortcut: Each active subscription with a matching filter (default filter is True, matches all) receives one copy of the message. Three subscriptions = three independent message copies.
What is the correct approach for a workload requiring FIPS 140-2 Level 3 key protection?
Shortcut: HSM-backed keys in the Premium tier, or a dedicated Managed HSM pool, provide hardware key protection at FIPS 140-2 Level 3. Standard tier uses software-protected keys.
A team uses DAPR for state management. Which component type do they configure to connect to Azure Cosmos DB as a state store?
Shortcut: DAPR state store components define the backend for the State Management building block. Azure Cosmos DB, Redis, and Azure Table Storage can serve as DAPR state stores.
An application opens thousands of short-lived connections and the server hits its connection limit. Which built-in feature addresses this?
Shortcut: Flexible Server includes PgBouncer. Transaction-mode pooling multiplexes many client connections onto a small set of server connections, which is the correct fix for connection churn.
What is the fundamental difference between Event Grid and Service Bus?
Shortcut: Event Grid is a reactive eventing service optimised for fan-out notification. Service Bus is enterprise messaging with sessions, transactions, dead-lettering, and ordering.
Which Azure service enforces organizational policies across subscriptions, such as requiring all resources to be in specific regions?
Shortcut: Azure Policy enforces governance rules (deny non-compliant resources, audit, modify/remediate). A policy denying resource creation outside allowed regions prevents deployment in disallowed locations regardless of RBAC.
A background job must run to completion on a schedule and then stop. Which Container Apps resource type fits?
Shortcut: Container Apps Jobs run to completion rather than serving traffic. Trigger types include manual, schedule (cron), and event-driven, with retry and parallelism settings.
Which Cosmos DB feature automatically captures all changes to documents in a container in the order they occur?
Shortcut: Change feed provides a persistent, ordered log of all inserts and updates (not deletes by default) to a container. Consumers (Functions, SDK processors) can read the feed for event-driven processing.
A serverless webhook endpoint needs to validate that it is a legitimate Event Grid subscriber before receiving events. Which Event Grid validation mechanism must it handle?
Shortcut: When creating a webhook subscription, Event Grid sends a SubscriptionValidationEvent containing a validationCode. The handler must return the code in the response within 5 minutes to confirm ownership.